Skip to content
OpenAdvisories

Package · npm

@budibase/worker

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.8
    CVE-2026-45716

    Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration

    Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware, allowing any user with builder permissions to access it. When SMTP email is not configured (the defa…

    Budibase budibase @budibase/worker npm
  • High 8.8
    CVE-2022-3225

    Improper Control of Dynamically-Managed Code Resources in budibase/budibase

    Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20.

    Budibase budibase/budibase @budibase/worker @budibase/bbui npm